logstash grok filter pattern to extract (root) "Caused by:" from java stack trace

log event example

com.xx.Exception: java.io.FileNotFoundException
	at org.apache.cxf.jaxrs.JAXRSInvoker.handleFault(JAXRSInvoker.java:324)
        ...
Caused by: java.lang.RuntimeException: java.io.FileNotFoundException
	at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:200)
	... 46 more
Caused by: com.xx.WrongSizeException: blahblah
	... 64 more

logstash.conf

input {
  log4j {
    mode => "server"
    host => "127.0.0.1"
    port => 9527
    type => "log4j"
  }
}
filter {
  if [type] == "log4j" {
    grok {
      match => [ "stack_trace", "(?!.*Caused by:)by: %{NOTSPACE:caused_by}"]
    }
  }
}
output {
 #...
}

result

 com.xx.WrongSizeException